Port Scanner

Check which TCP ports are open on any host or IP address

Port Preset
Try:
This tool only scans well-known ports on public hosts. Private and reserved IPs are blocked.

Frequently Asked Questions

A port scanner checks which TCP ports on a server are open and accepting connections. Ports are numbered endpoints (0–65535) that allow different network services to run on the same server. Port 80 is HTTP, port 443 is HTTPS, port 22 is SSH, etc. Open ports indicate running services; closed ports mean nothing is listening there or a firewall is blocking the connection.
Open: A service is actively listening on the port and the TCP connection succeeded. Closed: The port is not open — either no service is running on that port, or a firewall is dropping/rejecting packets. This tool uses TCP connect scanning — if the connection is established within the timeout, the port is marked open.
Port scanning your own servers is always legal. Scanning third-party servers without permission may be illegal in many jurisdictions and is a violation of most hosting terms of service. This tool is intended for scanning your own public-facing servers to audit your firewall configuration. Only scan servers you own or have explicit permission to test.
Each closed/filtered port must wait for a TCP connection timeout (1.5 seconds per port in this tool). For the Top 50 preset, a host with mostly closed ports could take up to 75 seconds. Open ports respond instantly. Firewalls that drop packets (rather than send a TCP RST) cause the most delay. Use the "Common" preset for faster results.
For a web server, you typically want port 80 (HTTP) and 443 (HTTPS) open, and everything else closed. Common security concerns: port 22 (SSH) should be restricted to known IPs, port 3306 (MySQL) and 5432 (PostgreSQL) should never be publicly open, port 3389 (RDP) is a frequent brute-force target. Open database and admin ports on public servers are a serious security risk.
scanme.nmap.org is a server maintained by the Nmap project specifically for port scanning tests. It has explicit permission for the public to scan it, making it a safe target for testing port scanners. Ports 22 and 80 are intentionally open on that host.
Well-known port assignments: 21 — FTP; 22 — SSH; 25 — SMTP; 53 — DNS; 80 — HTTP; 443 — HTTPS; 3306 — MySQL; 5432 — PostgreSQL; 6379 — Redis; 27017 — MongoDB; 3389 — RDP; 8080/8443 — common HTTP/HTTPS alternates. Ports 0–1023 are "well-known" system ports; 1024–49151 are registered ports; 49152–65535 are dynamic/private ports.
A closed port actively refuses connections — the server responds with a TCP RST packet, meaning the port is reachable but no service is listening. A filtered port does not respond at all — a firewall silently drops packets destined for that port. From a security standpoint, filtered is preferable because it reveals less information. This tool uses TCP connect scans with a timeout, so ports that don't respond are treated as closed/filtered — it cannot distinguish between them without SYN scanning.
TCP is connection-oriented — it establishes a handshake before data transfer and guarantees delivery and ordering. Most protocols (HTTP, SSH, SMTP) run over TCP. UDP is connectionless — packets are sent without a handshake. UDP is used where speed matters more than reliability: DNS (53), DHCP (67/68), VoIP, game servers, and QUIC/HTTP3. This tool only scans TCP ports.
Port scanning systems you own or have explicit permission to test is legal and standard security practice. Scanning systems without permission may violate computer crime laws (such as the CFAA in the US, or the Computer Misuse Act in the UK), and violates terms of service of virtually every hosting provider. Even passive scans can trigger intrusion detection and lead to IP blocks or legal complaints. Rule: only scan what you own or have clear permission to test.

About This Port Scanner

This free online Port Scanner performs TCP connect scans on any public host. Select from presets (Common, Top 50, Web, Database, Mail) or enter a custom port list. Results show each port's status and the associated service name. Private and reserved IP addresses are blocked to prevent abuse.

Common Ports Reference

PortProtocolService
22TCPSSH
25TCPSMTP
80TCPHTTP
443TCPHTTPS
3306TCPMySQL
5432TCPPostgreSQL
6379TCPRedis
27017TCPMongoDB

Port Ranges

RangeCategory
0–1023Well-known / System
1024–49151Registered
49152–65535Dynamic / Ephemeral

Related Internet Tools

Ping Traceroute WHOIS Lookup Subnet Calculator

Related Articles

In-depth guides and technical articles.

View all →
Internet Jul 7, 2026
What Port Scanning Means in a Zero Trust Network — Microsegmentation, mTLS, and Kubernetes Exposure
Zero Trust networking changes what open internal ports mean — in a perimeter model, internal ports are assumed safe; in Zero Trust, every service must authenticate every connection regardless of network location. Here's how microsegmentation makes port scanning a policy verification tool, why service mesh mTLS decouples open ports from accessible services, and what Kubernetes port exposure looks like from an external scanner.
Internet Jun 23, 2026
Shodan Already Has Your Open Ports — What Attackers Learn From Port Scans and Why You Should Run Them Too
The entire internet-facing IPv4 space can be scanned in under an hour — Shodan and Censys already have your server's open ports catalogued. Here's what banner grabbing reveals (exact software versions → known CVEs), the difference between open/closed/filtered port states and why "filtered" is the preferred security posture, why SYN scanning doesn't appear in application logs, and what to look for when port scanning your own infrastructure.
Internet Jun 15, 2026
IPv6's Address Space Is Too Big to Scan — Here's Why That Doesn't Make It Secure
A misconfigured open port on an IPv4 server gets found by automated scanners within hours, because the entire IPv4 address space is small enough to scan exhaustively. The same misconfiguration on an IPv6 server might never be found this way — not because it's more secure, but because 2^128 addresses is too large to scan at any practical rate. Here's how IPv6 hosts actually get discovered instead (DNS records, certificate transparency logs, predictable address patterns), and why "too big to scan" is security through obscurity, not security.
Internet Jun 12, 2026
NAT and Port Forwarding for Home Networks: Why "Filtered" Doesn't Mean "Firewalled"
Most home network ports show "filtered" from the internet — not because of a configured firewall, but as a side effect of how NAT works: incoming connections without an existing mapping have nowhere to go. Here's the open/closed/filtered distinction, how NAT creates this effect, why port forwarding and UPnP change it, and the CGNAT limitation that can make port forwarding fail entirely.
Internet Jun 10, 2026
Cloud Security Groups: AWS, GCP, Azure — Common Misconfigurations and How to Audit Them
Every major cloud breach has the same pattern: legitimate infrastructure, misconfigured security groups. Here's how AWS Security Groups, GCP Firewall Rules, and Azure NSGs work, the most common dangerous misconfigurations (databases open to 0.0.0.0/0), and why scanning your own cloud infrastructure is security hygiene.